Splunk Search

How to convert splunk dashboard panel with dynamic token in reports?

karthi2809
Builder

Hi All,

I have a Splunk dashboard with dynamic token, Here a simplified example of my setup. In the dashboard $new_value$ and $env$  are dynamic token that user can select. I want to convert this panel into report that can accommodate these dynamic values. Could you guide me how to achieve this ?.I need to understand. Any details steps or examples would be greatly appreciated.

Base Query:
index=Test environment=$env$ applicationName=$new_value$ 
 | stats values(content.InterfaceName) as InterfaceName values(content.payload) as payloadFile values(content.ErrorMsg) as  errormsg  values(content.Error) as error BY  applicationName,correlationId
| table  Status Timestamp InterfaceName ApplicationName  CorrelationId
| search  interfaceName=$new_interface$ 

Panel Query with dynamic tokens:
 <search base="BankSearch">
          <query>| where Status LIKE ("$countStatus$")|sort -Timestamp</query></search>

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @karthi2809,

for my knowledge, reports are static objects and you cannot pass a token to a report.

Why do you want to do this?

if it's to accelerate searches, use other methods as Data_nodels or Summary indexes.

Ciao.

giuseppe

0 Karma

karthi2809
Builder

Hi @gcusello 

Thanks for the reply. Actually i want to improve my dashboard performance. So i try to convert as report. But as you said its static. So if i use summary index or data model we can pass token ?any sample data model .And both will consume license right?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @karthi2809,

Yes, you can pass a token to a search based on DataModels or Summary Indexes.

Both of them don't consume license.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...